Search Images Maps Play YouTube News Gmail Drive More »
Sign in
Screen reader users: click this link for accessible mode. Accessible mode has the same essential features but works better with your reader.

Patents

  1. Advanced Patent Search
Publication numberUS7690034 B1
Publication typeGrant
Application numberUS 10/938,047
Publication dateMar 30, 2010
Filing dateSep 10, 2004
Priority dateSep 10, 2004
Fee statusPaid
Publication number10938047, 938047, US 7690034 B1, US 7690034B1, US-B1-7690034, US7690034 B1, US7690034B1
InventorsAhmed Sallam
Original AssigneeSymantec Corporation
Export CitationBiBTeX, EndNote, RefMan
External Links: USPTO, USPTO Assignment, Espacenet
Using behavior blocking mobility tokens to facilitate distributed worm detection
US 7690034 B1
Abstract
Behavior blocking mobility token managers track movement of suspicious files within a network. A behavior blocking mobility token manager on a source computer detects an attempt by a process on the source computer to write a file to a target computer. The behavior blocking mobility token manager determines a suspicion level associated with the process, and writes a behavior blocking mobility token containing at least the suspicion level associated with the process to the target computer. A behavior blocking mobility token manager on the target computer detects that a behavior blocking mobility token is being written to the target computer. The behavior blocking mobility token manager reads the behavior blocking mobility token, and determines a suspicion level of the file associated with the behavior blocking mobility token, responsive to contents of the behavior blocking mobility token.
Images(3)
Previous page
Next page
Claims(34)
1. A computer implemented method for tracking movement of suspicious files within a network, the method comprising the steps of:
detecting at a source computer a process on the source computer writing a file to a folder at a target computer;
determining at the source computer a suspicion level associated with the process;
writing by the source computer a first behavior blocking mobility token containing at least the suspicion level associated with the process to the same folder at the target computer;
subsequent to writing the file and the first behavior blocking mobility token to the same folder at the target computer, determining by the source computer whether the process comprises malicious code; and
writing by the source computer a second behavior blocking mobility token to the target computer, the second behavior blocking mobility token informing the target computer whether the process that wrote the file comprises malicious code.
2. The method of claim 1 wherein:
the first behavior blocking mobility token contains at least one datum concerning the source computer from a group of data consisting of:
an IP address;
a computer name; and
a primary domain controller name.
3. The method of claim 1 wherein:
the first behavior blocking mobility token contains at least one datum concerning the process from a group of data consisting of:
a name;
security information;
additional associated suspiciousness information;
an installation time;
an installation source;
data contained in a behavior blocking mobility token associated with the process;
a digital signature;
a version number;
a last modification date; and
a last modification time.
4. The method of claim 1 further comprising:
writing at least one instruction directed to the target computer in the first behavior blocking mobility token.
5. The method of claim 1 further comprising:
writing at least one rule directed to the target computer in the first behavior blocking mobility token.
6. The method of claim 1 wherein the second behavior blocking mobility token is written to the target computer through a named pipe.
7. A computer implemented method for tracking movement of suspicious files within a network, the method comprising the steps of:
detecting a file being written to a folder at a target computer by a source computer;
detecting that a first behavior blocking mobility token associated with the file is being written to the same folder at the target computer by the source computer;
reading the first behavior blocking mobility token;
determining a suspicion level of the file associated with the first behavior blocking mobility token, responsive to contents of the behavior blocking mobility token; and
subsequent to detecting the file and the first behavior blocking mobility token being written to the same folder at the target computer, detecting a second behavior blocking mobility token being written to the target computer, the second behavior blocking mobility token indicating whether the file was written to the target computer by malicious code on the source computer, wherein the source computer determines whether the file was written to the target computer by malicious code and writes the second behavior blocking mobility token to the target computer.
8. The method of claim 7 further comprising:
reading at least one instruction from the source computer in the first behavior blocking mobility token; and
executing the at least one instruction.
9. The method of claim 7 further comprising:
reading at least one rule from the source computer in the first behavior blocking mobility token; and
processing the file associated with the first behavior blocking mobility token responsive to the at least one rule.
10. The method of claim 7 further comprising:
processing the file associated with the first behavior blocking mobility token responsive to at least one rule originating at the target computer.
11. The method of claim 7 further comprising:
in response to at least the suspicion level, treating the file associated with the first behavior blocking mobility token as being suspicious.
12. The method of claim 7 further comprising:
in response to at least the suspicion level, rejecting the file associated with the first behavior blocking mobility token.
13. The method of claim 7 further comprising:
responsive to the second behavior mobility token indicating that the file was written to the target computer by malicious code, treating the associated file as malicious code.
14. The method of claim 7 wherein the second behavior mobility token is written to the target computer through a named pipe.
15. The method of claim 7 further comprising:
responsive to the second behavior mobility token indicating that the file was written to the target computer by legitimate code, treating the associated file as legitimate code.
16. The method of claim 7 further comprising:
responsive to not receiving communication from the source computer for a specified period of time, raising the suspicion level of the associated file.
17. A computer readable storage medium containing an executable computer program product for tracking movement of suspicious files within a network, the computer program product comprising:
program code for detecting at a source computer a process on the source computer writing a file to a folder at a target computer;
program code for determining at the source computer a suspicion level associated with the process;
program code for writing by the source computer a first behavior blocking mobility token containing at least the suspicion level associated with the process to the same folder at the target computer;
program code for determining by the source computer whether the process comprises malicious code subsequent to writing the file and the first behavior blocking mobility token to the same folder at the target computer; and
program code for writing by the source computer a second behavior blocking mobility token to the target computer, the second behavior blocking mobility token informing the target computer whether the process that wrote the file comprises malicious code.
18. The computer program product of claim 17 further comprising:
program code for writing at least one instruction directed to the target computer in the first behavior blocking mobility token.
19. The computer program product of claim 17 further comprising:
program code for writing at least one rule directed to the target computer in the first behavior blocking mobility token.
20. A computer readable storage medium containing an executable computer program product for tracking movement of suspicious files within a network, the computer program product comprising:
program code for detecting a file being written to a folder at a target computer by a source computer;
program code for detecting that a first behavior blocking mobility token associated with the file is being written to the same folder at the target computer by the source computer;
program code for reading the first behavior blocking mobility token;
program code for determining a suspicion level of the file associated with the first behavior blocking mobility token, responsive to contents of the behavior blocking mobility token; and
program code for detecting a second behavior blocking mobility token being written to the target computer subsequent to detecting the file and the first behavior blocking mobility token being written to the same folder at the target computer, the second behavior blocking mobility token indicating whether the file was written to the target computer by malicious code on the source computer, wherein the source computer determines whether the file was written to the target computer by malicious code and writes the second behavior blocking mobility token to the target computer.
21. The computer program product of claim 20 further comprising:
program code for reading at least one instruction from the source computer in the first behavior blocking mobility token; and
program code for executing the at least one instruction.
22. The computer program product of claim 20 further comprising:
program code for reading at least one rule from the source computer in the first behavior blocking mobility token; and
program code for processing the file associated with the first behavior blocking mobility token responsive to the at least one rule.
23. The computer program product of claim 20 further comprising:
program code for processing the file associated with the behavior blocking mobility token responsive to at least one rule originating at the target computer.
24. The computer program product of claim 20 further comprising:
responsive to the second behavior mobility token indicating that the file was written to the target computer by malicious code, treating the associated file as malicious code.
25. The computer program product of claim 20 further comprising:
responsive to the second behavior mobility token indicating that the file was written to the target computer by legitimate code, program code for treating the associated file as legitimate code.
26. A computer system having a computer-readable storage medium having executable computer program instructions embodied therein for tracking movement of suspicious files within a network, the computer system computer program instructions comprising:
a software portion configured to detect at a source computer a process on the source computer writing a file to a folder at a target computer;
a software portion configured to determine at the source computer a suspicion level associated with the process;
a software portion configured to write by the source computer a first behavior blocking mobility token containing at least the suspicion level associated with the process to the same folder at the target computer;
a software portion configured to determine by the source computer whether the process comprises malicious code subsequent to writing the file and the first behavior blocking mobility token to the same folder at the target computer; and
a software portion configured to write by the source computer a second behavior blocking mobility token to the target computer, the second behavior blocking mobility token informing the target computer whether the process that wrote the file comprises malicious code.
27. The computer system of claim 26 further comprising:
a software portion configured to write at least one instruction directed to the target computer in the first behavior blocking mobility token.
28. The computer system of claim 26 further comprising:
a software portion configured to write at least one rule directed to the target computer in the first behavior blocking mobility token.
29. A computer system having a computer-readable storage medium having executable computer program instructions embodied therein for tracking movement of suspicious files within a network, the computer program instructions comprising:
a software portion configured to detect a file being written to a folder at a target computer by a source computer;
a software portion configured to detect that a first behavior blocking mobility token associated with the file is being written to the same folder at the target computer by the source computer;
a software portion configured to read the first behavior blocking mobility token;
a software portion configured to determine a suspicion level of the file associated with the first behavior blocking mobility token, responsive to contents of the behavior blocking mobility token; and
a software portion configured to detect a second behavior blocking mobility token being written to the target computer subsequent to detecting the file and the first behavior blocking mobility token being written to the same folder at the target computer, the second behavior blocking mobility token indicating whether the file was written to the target computer by malicious code on the source computer, wherein the source computer determines whether the file was written to the target computer by malicious code and writes the second behavior blocking mobility token to the target computer.
30. The computer system of claim 29 further comprising:
a software portion configured to read at least one instruction from the source computer in the first behavior blocking mobility token; and
a software portion configured to execute the at least one instruction.
31. The computer system of claim 29 further comprising:
a software portion configured to read at least one rule from the source computer in the first behavior blocking mobility token; and
a software portion configured to process the file associated with the first behavior blocking mobility token responsive to the at least one rule.
32. The computer system of claim 29 further comprising:
a software portion configured to process the file associated with the first behavior blocking mobility token responsive to at least one rule originating at the target computer.
33. The computer system of claim 29 further comprising:
responsive to the second behavior mobility token indicating that the file was written to the target computer by malicious code, a software portion configured to treat the associated file as malicious code.
34. The computer system of claim 29 further comprising:
responsive to the second behavior mobility token indicating that the file was written to the target computer by legitimate code, a software portion configured to treat the associated file as legitimate code.
Description
TECHNICAL FIELD

This patent application is related to U.S. Pat. No. 7,337,327, filed on Mar. 30, 2004, titled “Using Mobility Tokens to Observe Malicious Mobile Code,” and having the same assignee (the mobility tokens application). The mobility tokens application is hereby incorporated by reference in its entirety.

RELATED APPLICATIONS

This patent application is related to U.S. patent application Ser. No. 10/814,843, filed on Mar. 30, 2004, titled “Using Mobility Tokens to Observe Malicious Mobile Code,” and having the same assignee (the mobility tokens application). The mobility tokens application is hereby incorporated by reference in its entirety.

BACKGROUND

Networked computers are vulnerable to malicious computer code attacks, such as worms, viruses and Trojan horses. As used herein, “malicious computer code” is any code that enters a computer without an authorized user's knowledge and/or without an authorized user's consent.

Malicious mobile executable files comprise a major security threat. Mobile executable files are typically not signed, and do not carry a digital signature. Thus, the identity of their author(s) is unknown, and they should be suspected of being potentially malicious. For example, worms are often spread as a form of malicious mobile executable file.

Malicious mobile executable files such as worms often utilize open shares to spread themselves within networks. However, legitimate code can also be copied within a network this way. It is advantageous to be able to determine whether code remotely copied across a network is malicious or not, so that malicious code can be blocked and eliminated, and legitimate code copied as desired.

Some malicious code management strategies involve determining a suspicion level of mobile files, and blocking files that appear to be malicious. This type of blocking system can convict and block certain operations of malicious mobile code upon the detection of their propagation, and upon reaching a sufficient level of confidence about the suspiciousness of their operations. Blocking systems typically attempt to identify worms spreading across a network by comparing incoming binary files with the a known image of a worm, or an image of the copying application. This technique is sufficient to identify worms that copy themselves without self-modification and without employing identity hiding techniques. However, many of today's worms are polymorphous or metamorphic, changing their binary image as they spread. Dynamic worms pose a challenge to today's behavior blocking systems.

Furthermore, future generations of computer worms are likely to be even harder to detect than contemporary worms, thus providing an ongoing challenge to behavior blocking systems. For example, a future worm might be designed such that it communicates with a normal web server through the legitimate hypertext transfer protocol (HTTP), and then downloads different malicious binary images to local random access memory only. Then, the worm could be downloaded binaries to open remote network shares, without writing them to disk locally. Such a case would create a big challenge to contemporary behavioral based worm detection systems.

There exist other scenarios (actual and potential) that are also not effectively covered by current behavior blocking systems. For example, consider the following case. A worm arrives at a local machine, and the local blocking system classifies the file as being suspicious, but does not convict it as being malicious. The worm is either polymorphous or capable of downloading new malicious binaries from the Internet to local random access memory. The worm then copies new malicious binaries to remote open network shares. The behavior blocking system on the remote computer allows the new binaries to be copied, since the parent application is classified as being only suspicious and is not yet convicted. Later, the local copy of the worm is convicted by the behavior blocking component on the local computer. The new remotely copied binaries are still not convicted on the remote computer, and are considered as being only suspicious applications. The remote user then activates the remote copies on the remote machine, and the worm attacks that computer and spreads further to other computers. So, although the worm is eventually convicted on the local machine, its distributed new binaries are not convicted, and are still active within the outer network.

What is needed are methods, systems and computer readable media that extend a malicious could blocking system to be able to detect and block dynamic malicious code, such as polymorphous worms, metamorphic worms, worms that copy download new binary images to remote computers and worms that are only later convicted locally.

SUMMARY OF INVENTION

The present invention comprises methods, systems and computer readable media for tracking movement of suspicious files within a network. In some embodiments, a behavior blocking mobility token manager on a source computer detects an attempt by a process on the source computer to write a file to a target computer. The behavior blocking mobility token manager determines a suspicion level associated with the process, and writes a behavior blocking mobility token containing at least the suspicion level associated with the process to the target computer. In some embodiments, the behavior blocking mobility token manager writes at least one instruction and/or rule directed to the target computer in the behavior blocking mobility token. A behavior blocking mobility token manager on the target computer detects that a behavior blocking mobility token is being written to the target computer. The behavior blocking mobility token manager reads the behavior blocking mobility token, and determines a suspicion level of the file associated with the behavior blocking mobility token, responsive to contents of the behavior blocking mobility token. In some embodiments, the behavior blocking mobility token manager executes at least one instruction embedded in mobility token from the source computer. In other embodiments, the behavior blocking mobility token manager on the target computer processes the file associated with the behavior blocking mobility token responsive to one or more rules sent by the behavior blocking mobility token manager on source computer and/or originating on the target computer.

The features and advantages described in this disclosure and in the following detailed description are not all-inclusive, and particularly, many additional features and advantages will be apparent to one of ordinary skill in the relevant art in view of the drawings, specification, and claims hereof. Moreover, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes, and may not have been selected to delineate or circumscribe the inventive subject matter, resort to the claims being necessary to determine such inventive subject matter.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram illustrating a high level overview of a source computer and a target computer processing suspicion mobility tokens, according to some embodiments of the present invention.

FIG. 2 is a block diagram illustrating a high level overview of a source computer and a target computer processing conviction and clearance mobility tokens, according to some embodiments of the present invention.

The Figures depict embodiments of the present invention for purposes of illustration only. One skilled in the art will readily recognize from the following discussion that alternative embodiments of the structures and methods illustrated herein may be employed without departing from the principles of the invention described herein.

DETAILED DESCRIPTION

FIG. 1 illustrates a high level overview of a system 100 for performing some embodiments of the present invention. A behavior blocking mobility token manager 101 uses behavior blocking mobility tokens 103 to track the movement of suspicious mobile files 105. It is to be understood that although the behavior blocking mobility token manager 101 is illustrated as a single entity, as the term is used herein a behavior blocking mobility token manager 101 refers to a collection of functionalities which can be implemented as software, hardware, firmware or any combination of the three. Where a behavior blocking mobility token manager 101 is implemented as software, it can be implemented as a standalone program, but can also be implemented in other ways, for example as part of a larger program, as a plurality of separate programs, or as one or more statically or dynamically linked libraries.

In some embodiments of the present invention, behavior blocking mobility token managers 101 are instantiated on multiple computers 107, 109 within a network. Thus, when a file 105 is remotely copied from a source computer 107 to a target computer 109, the behavior blocking mobility token manager 101 on the target computer 109 can utilize information gleaned by the behavior blocking mobility token manager 101 on the source computer 107.

To transmit information concerning files 105 remotely copied by application programs 115 to target computers 109, a behavior blocking mobility token manager 101 can utilize three different types of behavior blocking mobility tokens 103: suspicion tokens 103A, conviction tokens 103B and clearance tokens 103C. It is to be understood that these names are simply exemplary labels for behavior blocking mobility tokens 103 performing various functions. The separate names are used herein for readability, but suspicion tokens 103A, conviction tokens 103B and clearance tokens 103C are all to be considered behavior blocking mobility tokens 103. The details concerning how to create mobility tokens 103 and copy them from a source computer 107 to a target computer 109 are disclosed in the mobility tokens application.

A behavior blocking mobility token manager 101 typically automatically creates a suspicion token 103A on the remote network shared location 111 every time a new file 105 is remotely created by a suspicious application 115 running on the local computer 107. Depending on the context, the suspicious application 115 is referred to herein as a: process, writing process, suspicious process, application, application program, suspicious application, parent application, and local application. Note that the behavior blocking mobility token manager 101 can use any methodology to determine what constitutes a suspicious application 115. For example, the behavior blocking mobility token manager 101 can make such a determination based upon a suspicion level 113 generated by local behavior blocking functionality, based upon the source of the application 115 (e.g., e-mail, Internet download), etc. A suspicion token 103A allows the behavior blocking mobility token manager 101 on a source computer 107 to send information to the target computer 109 concerning about the potential suspiciousness of copied files 105.

A suspicion token 103A contains at least the suspicion level 113 pertaining to the application 115 on the source computer 107 that is writing the file 105 to the target computer 109. A suspicion level 113 can be generated by the behavior blocking mobility token manager 101, or gleaned by the behavior blocking mobility token manager 101 from, e.g., local behavior blocking functionality or anti-malicious code software. In various embodiments, suspicion tokens 103A can contain additional data concerning the writing process 115, such as its name, associated security information, additional associated suspiciousness information, its installation time on the source computer 107, the source of its installation, data contained in a behavior blocking mobility token 101 associated with the process 115, its digital signature, its version number, its most recent modification date and/or its most recent modification time. A suspicion token 103A can also contain data concerning the source computer 107, such as its IP address, computer name and/or primary domain controller name.

In some embodiments, a behavior blocking mobility token manager 101 running on a local computer 107 observes all the outgoing network file operations. In such embodiments, when a process 115 running on the local computer 107 writes a new file 105 to a remote computer 109, the behavior blocking mobility token manager 101 determines the suspicion level 113 of the process 115, and writes a suspicion token 103A containing at least this information to the folder on the remote computer 109 in which the new file 105 is created.

In some embodiments, the behavior blocking mobility token manager 101 writes a suspicion token 103A whenever any process 115 writes a file 105 to a remote target computer 109. In other embodiments, suspicion tokens 103A are only written when a suspicious process 115 writes remotely, or when any process 115 (or when a suspicious process 115) writes an executable image 117 to a remote location. In various embodiments an executable image 117 can by defined narrowly as executable code (e.g., a .exe file or a dynamic link library) or defined loosely as any image which contains instructions to a computer at any level, such as a script file.

Recall that the suspicion token 103A written to the target computer 109 contains information concerning the parent application 115 that has created the new file 105. This information is used by the behavior blocking mobility token manager 101 on the remote computer 109 to determine how to treat this newly created file 105.

The behavior blocking mobility token manager 101 on the remote computer 109 recognizes when a suspicion token 103A is being written thereto. The behavior blocking mobility token manager 101 reads the suspicion token 103A, and determines a suspicion level 113 to associate with the newly created file 105. From the contents of the suspicion token 103A, the behavior blocking mobility token manager 101 can glean at least the suspiciousness level 113 of the parent application 115. As noted above, the suspicion token 103A can also contain other relevant data, for example the time period within which the parent application 115 is considered to be malicious. In some embodiments, suspicion tokens 103A are time sensitive, and expire after certain period of time. This can be, for example, the time within which the parent application 115 is assumed to be suspicious.

A suspicion token 103A can also used to exchange instructions between behavior blocking mobility token managers 101 on local 107 and remote computers 109. For example, the behavior blocking mobility token manager 101 running on the local computer 107 allows a system administrator or other authorized party to specify rules to control the execution of files 105 created on remote computers 109 by local suspicious applications 115. The behavior blocking mobility token managers 101 can embed a corresponding instruction in a suspicion token 103A, which will be recognized by behavior blocking mobility token managers 101 on target computers 109. A behavior blocking mobility token manager 101 on a target computer 109 can then execute the instruction.

In some embodiments, the system administrator of the local computer 107 can specify rules that apply to the creation of suspicion tokens 103A. In some embodiments, a system administrator at the remote computer 109 can specify rules that apply to receiving suspicion tokens 103A from source computers 107.

Rules can, for example, direct a behavior blocking mobility token manager 101 to block the execution of the newly created file 105, so long as the parent application 115 is considered suspicious. This will protect the target computer 109 from attacks by worms that have not yet been convicted at the source computer 107.

The behavior blocking mobility token manager 101 on the remote computer 109 can establish a new set of rules for each type of suspicious mobile executable image 117 copied remotely by a suspicious application 115. The rules could be defined based on any of the information provided within the suspicion token 103A. For instance, the behavior blocking mobility token manager 101 might request blocking certain executable images 117 from running based on the suspicion level 113 of their parent application 115 and the time the parent application 115 arrived to the source computer 107.

The rule and instruction based features allow system administrators to define new mobile behavior blocking rules on both the source 107 and the target computers 109 to control how the behavior blocking information should be exported and imported between both protected computers 107, 109.

Turning to FIG. 2, in some embodiments the behavior blocking mobility token manager 101 running on a source computer 107 generates and distributes a conviction token 103B when a local application 115 that has copied at least one file 105 remotely is confirmed as being a malicious application 201. In such a case, the behavior blocking mobility token manager 101 writes a conviction token 103B to each remote network location where it previously wrote a suspicion token 103A corresponding to the now convicted application 201. The conviction token 103A informs the behavior blocking mobility token manager 101 on the remote computer that the file 105 in question was written thereto by malicious code 201. The behavior blocking mobility token manager 101 on the remote computer 109 recognizes the conviction token 103B, and in response treats the associated file as malicious.

In some embodiments, when a behavior blocking mobility token manager 101 on a source computer 107 determines that an application 115 that previously wrote at least one file 105 remotely is a legitimate application 203, the behavior blocking mobility token manager 101 generates and distributes a clearance token 103C. A clearance token 103C is similar to a conviction token 103B, except that it informs behavior blocking mobility token managers 101 on target computers 109 that an application 115 is no longer considered suspicious by the source computer 107. The behavior blocking mobility token manager 101 on a target computer 109 recognizes an arriving clearance token 103C, and in response treats the associated file 105 as legitimate.

When distributing either conviction 103B or clearance tokens 103C, the behavior blocking mobility token manager 101 on a source computer 107 notes all of the remote places where it previously wrote a suspicion token 103A concerning the file 105 in question. The local behavior blocking mobility token manager 101 then writes the corresponding conviction token 103B or clearance token 103C to all such remote locations.

As noted above, a suspicion token 103A is generated and deployed at the time a local application 115 writes a file 105 to a remote location. As disclosed in the mobility tokens application, this guarantees that the manager 101 can write successfully to the remote location, as the share is already available and the current user has proper access rights to copy the file 105 there. However, these rights may not be in effect when conviction tokens 103B and the clearance tokens 103C are deployed, as the share might no longer be available, or the current user might not have proper access rights. In one embodiment, a behavior blocking mobility token manager 101 addresses this issue by only sending a conviction token 103B or a clearance tokens 103C when a network share is still available upon conviction or clearance of a suspicious application 115. If a user removes the network share before that time, the behavior blocking mobility token manager 101 can follow directives specified in the behavior blocking rules to handle such a case.

In another embodiment, the behavior blocking mobility token managers 101 on both computers 107, 109 communicate through named pipes 205 in order to exchange conviction tokens 103B and the clearance tokens 103C. For example, under Windows NT®, named pipe 301 operations are executed by the network file sharing protocol, which guarantees that the network port number is not blocked by any network based firewall system as long as applications 115 can copy files 105 remotely.

Another similar case is when a source computer 107 has been taken out of the network or is in a deadlock state. This case can be interpreted by the behavior blocking mobility token manager 101 on the target computer 109 as an indication of the maliciousness of files 105 copied from that source computer 107. The behavior blocking mobility token manager 101 can associate a time-out with tokens 103 originating therefrom, such that if the source computer 107 fails to communicate through named pipes 205 within the specified time, the behavior blocking mobility token manager 101 on the target computer 109 takes stronger action against the copied files 105, for example by adjudicating them to be malicious.

The following use cases provide examples of the behavior blocking mobility token manager 101 in action, according to some embodiments of the present invention.

Use Case One:

    • An application 115 arrives at a computer 107 from the outside network.
    • Based on behavior blocking rules, the newly arrived application 115 is adjudicated as being suspicious.
    • The application 115 performs certain malicious operations locally, and therefore, its suspicious level 113 is increased.
    • The suspicious application 115 writes a new binary file 105 to a remote computer 109 via an open network share.
    • The behavior blocking mobility token manager 101 writes a corresponding suspicion token 103A to the same remote network shared folder on the target computer 109.
    • The behavior blocking mobility token manager 101 on the target computer 109 reads the suspicion token 103A and adjudicates the newly created file 105 as being suspicious.

Use Case Two:

    • An application 115 arrives at a computer 107 from the outside network.
    • Based on behavior blocking rules, the newly arrived application 115 is adjudicated as being suspicious.
    • The suspicious application 115 writes a new binary file 105 to a remote computer 109 via an open network share.
    • The behavior blocking mobility token manager 101 writes a corresponding suspicion token 103A to the same remote network shared folder on the target computer 109.
    • The behavior blocking rules on the remote computer 109 do not allow the newly copied file 105 to be executed until the writing application 115 is cleared by the source computer 107.
    • A user tries to run the newly created file 105 on the target computer 109, and the behavior blocking mobility token manager 101 blocks the execution thereof, and displays a message to the end user indicating that the file 105 is not trusted.
    • The parent application 115 is identified as being legitimate code 203 by the source computer 107.
    • The behavior blocking mobility token manager 101 on the source computer 107 generates a clearance token 103B, and writes it to the remote computer 109.
    • The behavior blocking mobility token manager 101 on the target computer 109 reads the clearance token 103B and adjudicates the file 105 as being legitimate.
    • The user tries to execute the file 105 on the target computer 109, and the behavior blocking mobility token manager 101 allows the file 105 to run.

As will be understood by those familiar with the art, the invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. Likewise, the particular naming and division of the modules, managers, features, attributes, methodologies and other aspects are not mandatory or significant, and the mechanisms that implement the invention or its features may have different names, divisions and/or formats. Furthermore, as will be apparent to one of ordinary skill in the relevant art, the modules, managers, features, attributes, methodologies and other aspects of the invention can be implemented as software, hardware, firmware or any combination of the three. Of course, wherever a component of the present invention is implemented as software, the component can be implemented as a script, as a standalone program, as part of a larger program, as a plurality of separate scripts and/or programs, as a statically or dynamically linked library, as a kernel loadable module, as a device driver, and/or in every and any other way known now or in the future to those of skill in the art of computer programming. Additionally, the present invention is in no way limited to implementation in any specific programming language, or for any specific operating system or environment. Accordingly, the disclosure of the present invention is intended to be illustrative, but not limiting, of the scope of the invention, which is set forth in the following claims.

Patent Citations
Cited PatentFiling datePublication dateApplicantTitle
US4776537Aug 8, 1986Oct 11, 1988British Aerospace PlcFuel storage means
US4888798Aug 7, 1986Dec 19, 1989Oms, Inc.Modular software security
US5050212Jun 20, 1990Sep 17, 1991Apple Computer, Inc.Method and apparatus for verifying the integrity of a file stored separately from a computer
US5103476Nov 7, 1990Apr 7, 1992Waite David PSecure system for activating personal computer software at remote locations
US5182770Apr 19, 1991Jan 26, 1993Geza MedveczkySystem and apparatus for protecting computer software
US5432851Oct 21, 1993Jul 11, 1995Tecsec IncorporatedPersonal computer access control system
US5440723Jan 19, 1993Aug 8, 1995International Business Machines CorporationAutomatic immune system for computers and computer networks
US5450576Apr 26, 1993Sep 12, 1995Ast Research, Inc.Distributed multi-processor boot system for booting each processor in sequence including watchdog timer for resetting each CPU if it fails to boot
US5452442Apr 14, 1995Sep 19, 1995International Business Machines CorporationMethods and apparatus for evaluating and extracting signatures of computer viruses and other undesirable software entities
US5473769Aug 31, 1992Dec 5, 1995Cozza; Paul D.Method and apparatus for increasing the speed of the detecting of computer viruses
US5530757Jun 28, 1994Jun 25, 1996International Business Machines CorporationDistributed fingerprints for information integrity verification
US5548532Apr 28, 1994Aug 20, 1996Thomson Consumer Electronics, Inc.Apparatus and method for formulating an interactive TV signal
US5564054Aug 25, 1994Oct 8, 1996International Business Machines CorporationFail-safe computer boot apparatus and method
US5572590Apr 12, 1994Nov 5, 1996International Business Machines CorporationComputer implemented method
US5596711Jan 26, 1995Jan 21, 1997Compaq Computer CorporationComputer failure recovery and alert system
US5606609Sep 19, 1994Feb 25, 1997Scientific-AtlantaElectronic document verification system and method
US5625693Jul 7, 1995Apr 29, 1997Thomson Consumer Electronics, Inc.Apparatus and method for authenticating transmitting applications in an interactive TV system
US5661848Sep 8, 1994Aug 26, 1997Western Digital CorpMulti-drive controller with encoder circuitry that generates ECC check bytes using the finite field for optical data for appending to data flowing to HDA
US5696822Sep 28, 1995Dec 9, 1997Symantec CorporationComputer implemented method
US5708776May 9, 1996Jan 13, 1998Elonex I.P. HoldingsAutomatic recovery for network appliances
US5715174Nov 15, 1994Feb 3, 1998Absolute Software CorporationSecurity apparatus and method
US5715464Jun 7, 1995Feb 3, 1998International Business Machines CorporationComputer system having suspend once resume many sessions
US5758359Oct 24, 1996May 26, 1998Digital Equipment CorporationMethod and apparatus for performing retroactive backups in a computer system
US5765151Aug 17, 1995Jun 9, 1998Sun Microsystems, Inc.System and method for file system fix-on-panic for a computer operating system
US5799088Dec 1, 1994Aug 25, 1998Raike; William MichaelNon-deterministic public key encrypton system
US5802080Mar 28, 1996Sep 1, 1998Seagate Technology, Inc.In a module for connection to a computer network
US5812763Jan 21, 1993Sep 22, 1998Digital Equipment CorporationExpert system having a plurality of security inspectors for detecting security flaws in a computer system
US5854759May 5, 1997Dec 29, 1998Rsa Data Security, Inc.Methods and apparatus for efficient finite field basis conversion
US5889943Mar 29, 1996Mar 30, 1999Trend Micro IncorporatedApparatus and method for electronic mail virus detection and elimination
US5919258 *Feb 6, 1997Jul 6, 1999Hitachi, Ltd.Security system and method for computers connected to network
US5922072Jan 3, 1997Jul 13, 1999Ncr CorporationMethod and apparatus for creating alternate boot environments in a computer
US5951698Oct 2, 1996Sep 14, 1999Trend Micro, IncorporatedSystem, apparatus and method for the detection and removal of viruses in macros
US5956475Dec 18, 1996Sep 21, 1999Compaq Computer CorporationComputer failure recovery and alert system
US5956481 *Feb 6, 1997Sep 21, 1999Microsoft CorporationMethod and apparatus for protecting data files on a computer from virus infection
US5960170Mar 18, 1997Sep 28, 1999Trend Micro, Inc.Event triggered iterative virus detection
US5974546May 8, 1997Oct 26, 1999Micron Electronics, Inc.Apparatus and method to determine cause of failed boot sequence to improve likelihood of successful subsequent boot attempt
US5978475 *Jul 18, 1997Nov 2, 1999Counterpane Internet Security, Inc.Event auditing system
US5978917Aug 14, 1997Nov 2, 1999Symantec CorporationDetection and elimination of macro viruses
US5987610Feb 12, 1998Nov 16, 1999Ameritech CorporationComputer virus screening methods and systems
US6000032Jul 15, 1997Dec 7, 1999Symantec CorporationSecure access to software modules
US6014744Jan 13, 1998Jan 11, 2000Microsoft CorporationState governing the performance of optional booting operations
US6014767Apr 1, 1997Jan 11, 2000International Business Machines CorporationMethod and apparatus for a simple calculation of CRC-10
US6048090Apr 23, 1997Apr 11, 2000Cirrus Logic, Inc.Error correction and concurrent verification of a product code
US6052709Dec 23, 1997Apr 18, 2000Bright Light Technologies, Inc.Apparatus and method for controlling delivery of unsolicited electronic mail
US6061788Oct 2, 1997May 9, 2000Siemens Information And Communication Networks, Inc.System and method for intelligent and reliable booting
US6070244Nov 10, 1997May 30, 2000The Chase Manhattan BankComputer network security management system
US6072830Aug 9, 1996Jun 6, 2000U.S. Robotics Access Corp.Method for generating a compressed video signal
US6079016May 7, 1997Jun 20, 2000Samsung Electronics Co., Ltd.Computer with multi booting function
US6088803Dec 30, 1997Jul 11, 2000Intel CorporationSystem for virus-checking network data during download to a client device
US6094731Nov 9, 1998Jul 25, 2000Symantec CorporationAntivirus accelerator for computer networks
US6104872Jun 14, 1996Aug 15, 2000Fujitsu LimitedMacro program management system
US6108799Mar 12, 1998Aug 22, 2000International Business Machines CorporationAutomated sample creation of polymorphic and non-polymorphic marcro viruses
US6167434Jul 15, 1998Dec 26, 2000Pang; Stephen Y.Computer code for removing junk e-mail messages
US6167520 *Jan 29, 1997Dec 26, 2000Finjan Software, Inc.System and method for protecting a client during runtime from hostile downloadables
US6192379Jun 26, 1998Feb 20, 2001British Telecommunications Public Limited CompanyData model compiler selectively using a reference store of labelled program components within a common class
US6199181Sep 9, 1998Mar 6, 2001Perfecto Technologies Ltd.Method and system for maintaining restricted operating environments for application programs or operating systems
US6275938Aug 28, 1997Aug 14, 2001Microsoft CorporationSecurity enhancement for untrusted executable code
US6338141Sep 30, 1998Jan 8, 2002Cybersoft, Inc.Method and apparatus for computer virus detection, analysis, and removal in real time
US6357008Sep 23, 1997Mar 12, 2002Symantec CorporationDynamic heuristic method for detecting computer viruses using decryption exploration and evaluation phases
US6370648Dec 8, 1998Apr 9, 2002Visa International Service AssociationComputer network intrusion detection
US6493007Jul 15, 1998Dec 10, 2002Stephen Y. PangMethod and device for removing junk e-mail messages
US6535891Sep 26, 2000Mar 18, 2003Emc CorporationMethod and apparatus for indentifying accesses to a repository of logical objects stored on a storage system based upon information identifying accesses to physical storage locations
US6552814Nov 4, 1998Apr 22, 2003Brother Kogyo Kabushiki KaishaPrint system for executing printing operations based on macros selectively designated on document set basis
US6611925Jun 13, 2000Aug 26, 2003Networks Associates Technology, Inc.Single point of entry/origination item scanning within an enterprise or workgroup
US6622150Dec 18, 2000Sep 16, 2003Networks Associates Technology, Inc.System and method for efficiently managing computer virus definitions using a structured virus database
US6678734Nov 13, 1999Jan 13, 2004Ssh Communications Security Ltd.Method for intercepting network packets in a computing device
US6697950Dec 22, 1999Feb 24, 2004Networks Associates Technology, Inc.Method and apparatus for detecting a macro computer virus using static analysis
US6701348 *Dec 22, 2000Mar 2, 2004Goodcontacts.ComMethod and system for automatically updating contact information within a contact database
US6721721Jun 15, 2000Apr 13, 2004International Business Machines CorporationVirus checking and reporting for computer database search results
US6748534Mar 31, 2000Jun 8, 2004Networks Associates, Inc.System and method for partitioned distributed scanning of a large dataset for viruses and other malware
US6763462Oct 5, 1999Jul 13, 2004Micron Technology, Inc.E-mail virus detection utility
US6813712Aug 17, 1999Nov 2, 2004International Business Machines CorporationViral replication detection using a counter virus
US6847984 *Dec 16, 1999Jan 25, 2005Livevault CorporationSystems and methods for backing up data files
US6851057Nov 30, 1999Feb 1, 2005Symantec CorporationData driven detection of viruses
US6910134Aug 29, 2000Jun 21, 2005Netrake CorporationMethod and device for innoculating email infected with a virus
US6944772 *Dec 26, 2002Sep 13, 2005D'mitri DozortsevSystem and method of enforcing executable code identity verification over the network
US7024548 *Mar 10, 2003Apr 4, 2006Cisco Technology, Inc.Methods and apparatus for auditing and tracking changes to an existing configuration of a computerized device
US7080000 *Jul 23, 2001Jul 18, 2006Mcafee, Inc.Method and system for bi-directional updating of antivirus database
US7103913 *May 8, 2002Sep 5, 2006International Business Machines CorporationMethod and apparatus for determination of the non-replicative behavior of a malicious program
US7152240 *Jul 25, 2000Dec 19, 2006Green Stuart DMethod for communication security and apparatus therefor
US7310818 *Oct 25, 2001Dec 18, 2007Mcafee, Inc.System and method for tracking computer viruses
US7343624 *Jun 16, 2005Mar 11, 2008Sonicwall, Inc.Managing infectious messages as identified by an attachment
US20020004908Mar 20, 2001Jan 10, 2002Nicholas Paul Andrew GaleaElectronic mail message anti-virus system and method
US20020035696Jun 7, 2001Mar 21, 2002Will ThackerSystem and method for protecting a networked computer from viruses
US20020046275Jun 12, 2001Apr 18, 2002Mark CrosbieSystem and method for host and network based intrusion detection and response
US20020083175Aug 14, 2001Jun 27, 2002Wanwall, Inc. (A Delaware Corporation)Methods and apparatus for protecting against overload conditions on nodes of a distributed network
US20020091940Jan 5, 2001Jul 11, 2002Welborn Christopher MichaelE-mail user behavior modification system and mechanism for computer virus avoidance
US20020116635 *Feb 14, 2002Aug 22, 2002Invicta Networks, Inc.Systems and methods for creating a code inspection system
US20020157008Apr 19, 2001Oct 24, 2002Cybersoft, Inc.Software virus detection methods and apparatus
US20020162015Sep 25, 2001Oct 31, 2002Zhaomiao TangMethod and system for scanning and cleaning known and unknown computer viruses, recording medium and transmission medium therefor
US20020178374May 25, 2001Nov 28, 2002International Business Machines CorporationMethod and apparatus for repairing damage to a computer system using a system rollback mechanism
US20030023865Jul 26, 2001Jan 30, 2003Cowie Neil AndrewDetecting computer programs within packed computer files
US20030051026Jan 19, 2001Mar 13, 2003Carter Ernst B.Network surveillance and security system
US20030065926Jul 30, 2002Apr 3, 2003Schultz Matthew G.System and methods for detection of new malicious executables
US20030115485Sep 20, 2002Jun 19, 2003Milliken Walter ClarkHash-based systems and methods for detecting, preventing, and tracing network worms and viruses
US20030120951Dec 21, 2001Jun 26, 2003Gartside Paul NicholasGenerating malware definition data for mobile computing devices
US20030126449Dec 28, 2001Jul 3, 2003Kelly Nicholas PaulControlling access to suspicious files
US20030140049Dec 21, 2001Jul 24, 2003Cybersoft, Inc.Apparatus, methods and articles of manufacture for securing and maintaining computer systems and storage media
US20030159070 *Nov 22, 2002Aug 21, 2003Yaron MayerSystem and method for comprehensive general generic protection for computers against malicious programs that may steal information and/or cause damages
US20030191966Apr 9, 2002Oct 9, 2003Cisco Technology, Inc.System and method for detecting an infective element in a network environment
US20030212902May 13, 2002Nov 13, 2003Van Der Made Peter A.J.Computer immune system and method for detecting unwanted code in a P-code or partially compiled native-code program executing within a virtual machine
US20030212913 *May 5, 2003Nov 13, 2003David VellaSystem and method for detecting a potentially malicious executable file
US20030236995Jun 21, 2002Dec 25, 2003Fretwell Lyman JeffersonMethod and apparatus for facilitating detection of network intrusion
US20040015712Oct 4, 2002Jan 22, 2004Peter SzorHeuristic detection of malicious computer code by page tracking
US20040015726Sep 25, 2002Jan 22, 2004Peter SzorPreventing e-mail propagation of malicious computer code
US20040030913Aug 8, 2002Feb 12, 2004Trend Micro IncorporatedSystem and method for computer protection against malicious electronic mails by analyzing, profiling and trapping the same
US20040111632 *May 5, 2003Jun 10, 2004Avner HalperinSystem and method of virus containment in computer networks
US20040158730Feb 11, 2003Aug 12, 2004International Business Machines CorporationRunning anti-virus software on a network attached storage device
US20040162808Jan 7, 2004Aug 19, 2004Permabit, Inc., A Delaware CorporationData repository and method for promoting network storage of data
US20040181687Mar 14, 2003Sep 16, 2004Nachenberg Carey S.Stream scanning through network proxy servers
US20040225877 *Mar 3, 2004Nov 11, 2004Zezhen HuangMethod and system for protecting computer system from malicious software operation
US20050021740Feb 5, 2004Jan 27, 2005Bar Anat BremlerDetecting and protecting against worm traffic on a network
US20050044406Mar 28, 2003Feb 24, 2005Michael StuteAdaptive behavioral intrusion detection systems and methods
US20050132205Dec 12, 2003Jun 16, 2005International Business Machines CorporationApparatus, methods and computer programs for identifying matching resources within a data processing network
US20050177736Jul 26, 2004Aug 11, 2005De Los Santos Aldous C.System and method for securing computers against computer virus
US20050204150Aug 21, 2004Sep 15, 2005Cyrus PeikariAttenuated computer virus vaccine
US20050216762 *Mar 24, 2005Sep 29, 2005Cyrus PeikariProtecting embedded devices with integrated reset detection
US20050273856 *May 17, 2005Dec 8, 2005Huddleston David EMethod and system for isolating suspicious email
US20060015939 *Jul 14, 2004Jan 19, 2006International Business Machines CorporationMethod and system to protect a file system from viral infections
US20060064755Sep 21, 2004Mar 23, 2006Agere Systems Inc.Methods and apparatus for interface adapter integrated virus protection
Non-Patent Citations
Reference
1"Description of Windows 2000 Windows File Protection Feature (Q222193)", [online], first published May 26, 1999, last modified Jan. 12, 2002, [retrieved on Apr. 9, 2002] Retrieved from the Internet .
2"News Release-Symantec Delivers Cutting-Edge Anti-Virus Technology with Striker32", Oct. 1, 1999, 2 pages, [online]. Retrieved on Nov. 11, 2003. Retrieved from the Internet:. Author unknown.
3"Software: Windows ME; Windows ME and System File Protection", [online] last updated Mar. 11, 2002, [retrieved on Apr. 9, 2002] Retrieved from the Internet: .
4"System File Protection and Windows ME", [online], last updated Dec. 4, 2001, [retrieved on Apr. 9, 2002] Retrieved from the Internet: .
5"Description of Windows 2000 Windows File Protection Feature (Q222193)", [online], first published May 26, 1999, last modified Jan. 12, 2002, [retrieved on Apr. 9, 2002] Retrieved from the Internet <URL: http://support.microsoft.com/default.aspx?scid=kb:EN-US;q222193>.
6"News Release—Symantec Delivers Cutting-Edge Anti-Virus Technology with Striker32", Oct. 1, 1999, 2 pages, [online]. Retrieved on Nov. 11, 2003. Retrieved from the Internet:<URL:http://www.symantec.com/press/1999/n991001.html>. Author unknown.
7"Software: Windows ME; Windows ME and System File Protection", [online] last updated Mar. 11, 2002, [retrieved on Apr. 9, 2002] Retrieved from the Internet: <URL: http//www.wackyb.co.nz/mesfp.html>.
8"System File Protection and Windows ME", [online], last updated Dec. 4, 2001, [retrieved on Apr. 9, 2002] Retrieved from the Internet: <URL: http://www.Microsoft.com/hwdev/archive/sfp/winME—sfpP.asp>.
9Bakos et al., "Early Detection of Internet Work Activity by Metering ICMP Destination Unreachable Activity.", Proc. of SPIE Conference on Sensors, and Command, Control, Communications and Intelligence, Orlando, Apr. 2002.
10Delio, M., "Virus Throttle a Hopeful Defense", Wired News, Dec. 9, 2002, retrieved from Internet Http://www.wired.com/news/print/0,1294,56753,00.html Jan. 7, 2003.
11Kephart, Jeffrey et al., "An Immune System for Cyberspace" IBM Thomas J. Watson Research Center, IEEE 1997, pp. 879-884.
12MacNamra, John E., "Technical Aspects of Data Communication", 2ed. 1982, Digital Equipment Corporation, U.S.A. pp. 110-122.
13Nair, et al., "A Symbol Based Algorithm for Hardware Implementation of Cycle Redundancy Check", IEEE, 1997.
14Ore, Oystein, "Number Theory and Its History", 1976 Gudron Ore, U.S.A. pp. 124-129.
15Parkhouse, Jayne, "Pelican SafeTNet 2.0", [online] Jun. 2000, SC Magazine Product Review, [retrieved Dec. 1, 2003] Retrieved from the Internet: .
16Parkhouse, Jayne, "Pelican SafeTNet 2.0", [online] Jun. 2000, SC Magazine Product Review, [retrieved Dec. 1, 2003] Retrieved from the Internet: <URL: http://www.scmagazine.com/standalone/pelican/sc—pelican.html>.
17Richter, J., Microsoft.com web pages (online). "Design a Windows NT Service to Exploit Special Operating System Facilities", Oct. 1997 (retrieved Aug. 29, 2003). Retrieved from the Internet: <URL: http://www.microsoft.com/msj/1097/winnt.aspx.
18Schneier, Bruce, "Applied Cryptography", 2ed. 1996, Bruce Schneier, U.S.A. pp. 436-441.
19Symantec Corporation, "Norton AntiVirus Corporate Edition", 1999, Version 1, pp. 15,22.
20Szor, P. and Ferrie, P., "Attacks in Win32 Part II", Virus Bulletin Conference, Sep. 2000, Virus Bulletin Ltd., The Pentagon, Abingdon, Oxfordshire, England, pp. 47-68.
21Szor, P. and Ferrie, P., "Hunting for Metamorphic", Virus Bulletin Conference, Sep. 2001, Virus Bulletin Ltd., The Pentagon, Abingdon, Oxfordshire, England, pp. 123-144.
22Szor, P. and Ferrie, P., Attacks on Win32, Virus Bulletin Conference, Sep. 1998, Virus Bulletin Ltd., The Pentagon, Abingdon, Oxfordshire, England, pp. 57-84.
23Szor, P., "Memory Scanning Under Windows NT", Virus Bulletin Conference, Sep. 1999, Virus Bulletin Ltd., The Pentagon, Abingdon, Oxfordshire, England, pp. 1-22.
24Toth, et al "Connection-history based anomaly detection" Proceedings of the 2002 IEEE Workshop on Information Assurance and Security. West Point, NY, Jun. 17-19, 2002. pp. 30-35.
25Von Babo, Michael, "Zehn Mythen um Computerviren: Dichtung und Wahrheit über den Schrecken des Informatikzeitalters," Technische Rundschau, Hallwag, Bern, Switzerland, vol. 84, No. 36. Sep. 4, 1992, pp. 44-47.
26Von Babo, Michael, "Zehn Mythnum Computerviren: Dichtug Und Wahrheit Uber Den Schrecken Des Informatkzeitlers," Technische Kundschau, Hallwag, Bern CH vol. 84, No. 36. Sep. 4, 1992, pp. 44-47.
Referenced by
Citing PatentFiling datePublication dateApplicantTitle
US8621615 *Jun 2, 2009Dec 31, 2013Juniper Networks, Inc.Behavior-based traffic profiling based on access control information
US20100257580 *Jun 2, 2009Oct 7, 2010Juniper Networks, Inc.Behavior-based traffic profiling based on access control information
Classifications
U.S. Classification726/22, 726/24, 726/23, 726/25
International ClassificationH04L29/00
Cooperative ClassificationH04L63/1416, G06F21/566, G06F21/552, G06F2221/2101, H04L63/145
European ClassificationG06F21/56C, G06F21/55A, H04L63/14D1
Legal Events
DateCodeEventDescription
Sep 30, 2013FPAYFee payment
Year of fee payment: 4
Sep 10, 2004ASAssignment
Owner name: SYMANTEC CORPORATION,CALIFORNIA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:SALLAM, AHMED;US-ASSIGNMENT DATABASE UPDATED:20100330;REEL/FRAME:15785/151
Effective date: 20040903
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:SALLAM, AHMED;REEL/FRAME:015785/0151